# Local Endpoints

<figure><img src="/files/ZSNXN8UzMqrIbHN1PnWQ" alt=""><figcaption></figcaption></figure>

**Audience:** IT admins who run management tasks against the agent (health checks, plugin control, jobs, settings) from scripts or tools.

### Overview

Keeper Privilege Manager exposes an **HTTP/HTTPS API** on **localhost only** (default ports 6888 HTTP, 6889 HTTPS). Use it for health checks, plugin start/stop/restart, job listing and trigger, settings and plugin settings, registration, and other management operations. All endpoints are **local** to the machine; they are not intended to be exposed to the network.

**Base URLs:**

* **HTTP:** `http://127.0.0.1:6888`
  * `HTTP: automatically redirects to HTTPS:`
* **HTTPS:** `https://127.0.0.1:6889`
  * Because this communication occurs entirely on the local machine, KEPM automatically manages the certificate lifecycle and validation. The certificate is kept in memory (not written to disk), is rotated internally, and a new certificate is generated each time the service starts.

**Authorization levels:**

* **Public** — No auth (health, root, system status).
* **Plugin** — Caller must be a process launched by Keeper Privilege Manager with valid certificate (e.g. plugins, jobs).
* **Elevated Admin** — Caller must have admin privileges (or be a trusted system process) and valid certificate.

Many management operations require **Plugin** or **Admin**. Scripts run manually often use **Admin** (e.g. from an elevated PowerShell or as root). For certificate-based calls, the product may provide a client certificate for script use; see your deployment docs.

## Public Endpoints (no auth)

Use these for monitoring and basic checks.

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="110.99993896484375">Method</th><th width="192.6666259765625">Path</th><th>Description</th></tr></thead><tbody><tr><td>GET</td><td><code>/health</code></td><td>Health check. Returns status (e.g. healthy), timestamp, version.</td></tr><tr><td>GET</td><td><code>/</code></td><td>Root; service name, status, version.</td></tr><tr><td>GET</td><td><code>/api/system/status</code></td><td>System status: running, plugin count, job count (total/enabled).</td></tr></tbody></table>

#### **Examples:**

```
curl -k https://localhost:6889/health
curl -k https://localhost:6889/
curl -k https://localhost:6889/api/system/status
```

## Plugin Management

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="99">Method</th><th width="262.6666259765625">Path</th><th width="82.6666259765625">Auth</th><th>Description</th></tr></thead><tbody><tr><td>GET</td><td><code>/api/plugins</code></td><td>Plugin</td><td>List all plugins (id, name, status, processId, lastStartTime).</td></tr><tr><td>POST</td><td><code>/api/plugins/{name}/start</code></td><td>Admin</td><td>Start a plugin.</td></tr><tr><td>POST</td><td><code>/api/plugins/{name}/stop</code></td><td>Admin</td><td>Stop a plugin.</td></tr><tr><td>POST</td><td><code>/api/plugins/{name}/restart</code></td><td>Admin</td><td>Restart a plugin.</td></tr></tbody></table>

Replace `{name}` with the plugin id (e.g. KeeperPolicy, KeeperAPI). Use these to recover from a stuck plugin or after changing plugin config.

## Job Management

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="98.3333740234375">Method</th><th width="248.3333740234375">Path</th><th width="82.666748046875">Auth</th><th>Description</th></tr></thead><tbody><tr><td>GET</td><td><code>/api/Jobs</code></td><td>Plugin</td><td>List all registered jobs (id, name, enabled, schedule, last run).</td></tr><tr><td>GET</td><td><code>/api/Jobs/{jobId}</code></td><td>Plugin</td><td>Get one job by id.</td></tr><tr><td>POST</td><td><code>/api/Jobs</code></td><td>Admin</td><td>Create a job (JSON body).</td></tr><tr><td>PUT</td><td><code>/api/Jobs/{jobId}</code></td><td>Admin</td><td>Update a job.</td></tr><tr><td>DELETE</td><td><code>/api/Jobs/{jobId}</code></td><td>Admin</td><td>Delete a job.</td></tr><tr><td>POST</td><td><code>/api/Jobs/{jobId}/run</code></td><td>Admin</td><td>Run job immediately.</td></tr><tr><td>POST</td><td><code>/api/Jobs/{jobId}/trigger</code></td><td>Admin</td><td>Trigger job with event context (JSON body).</td></tr><tr><td>POST</td><td><code>/api/Jobs/validate</code></td><td>Admin</td><td>Validate job JSON (POST body = job JSON).</td></tr></tbody></table>

Use **run** or **trigger** for on-demand execution; use **validate** before creating or updating jobs.

## Settings

### Plugin Settings

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="101.37109375">Method</th><th width="307.875">Path</th><th width="86.625">Auth</th><th>Description</th></tr></thead><tbody><tr><td>GET</td><td><code>/api/PluginSettings/{pluginName}</code></td><td>Plugin</td><td>Get all settings for a plugin.</td></tr><tr><td>GET</td><td><code>/api/PluginSettings/{pluginName}/{settingName}</code></td><td>Plugin</td><td>Get one plugin setting.</td></tr><tr><td>PUT</td><td><code>/api/PluginSettings/{pluginName}/{settingName}</code></td><td>Admin</td><td>Update one plugin setting (body = value).</td></tr><tr><td>POST</td><td><code>/api/PluginSettings/revert-all</code></td><td>Admin</td><td>Re-import all plugin settings from their JSON files on disk.</td></tr><tr><td>POST</td><td><code>/api/PluginSettings/{pluginName}/revert</code></td><td>Admin</td><td>Re-import one plugin’s settings from its JSON file.</td></tr></tbody></table>

Use **revert** or **revert-all** after editing plugin JSON files or after pushing config via policy so the in-memory settings match disk.

### Keeper Registration

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="107.69140625">Method</th><th>Path</th><th>Auth</th><th>Description</th></tr></thead><tbody><tr><td>GET</td><td><code>/api/Keeper/registration</code></td><td>Plugin</td><td>Get agent registration status (AgentUID, IsRegistered, Hostname, etc.).</td></tr><tr><td>POST</td><td><code>/api/Keeper/register</code></td><td>Admin (or public in some deployments)</td><td>Register agent; query param <code>token=...</code> (and optional <code>force=true</code>).</td></tr><tr><td>POST</td><td><code>/api/Keeper/unregister</code></td><td>Admin</td><td>Unregister agent.</td></tr></tbody></table>

#### **Example (register):**

```
curl -X POST "https://localhost:6889/api/Keeper/register?token=YOUR_TOKEN" -k
```

## Other Endpoint Groups

The API also includes endpoints for:

* **Audit** — GET/POST audit events.
* **Notifications** — Send notifications.
* **File access** — Request, grant, revoke file access; history.
* **User session** — Launch process in user session, validate launch.
* **Ephemeral** — Launch ephemeral account, list/delete accounts, cleanup.
* **Controls** — Control requests, approvals, launch approved request.
* **Credentials** — Risk assessment credentials (store/get/delete).
* **Path variables** — Create/update/delete custom path variables (if enabled).

Exact paths and request/response shapes follow the product’s API; the tables above cover the most common **management** tasks. For scripting, use **HTTPS**, handle **403** (auth) and **404** (not found), and use Admin or the appropriate certificate where required.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/endpoint-privilege-manager/reference/local-endpoints.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.